What does the Mills Review mean for a small advice firm?

Nothing new to comply with, and three pages to write before the FCA publishes its AI good and poor practice examples later this year: what AI is in use in the firm, who signs off each use that touches a client and how you would reconstruct an output if asked. A firm of six can do it in a fortnight.

That is the short answer. The rest of this piece is the working, because I wrote a longer argument last week about why the review is not permission to wait. The obvious follow-up from a small firm is some version of “fine, but we are two advisers, a paraplanner and an administrator, so what does any of this actually mean for us”. Fair question. The review was written with banks and platforms in the frame. This is the version for the firm with one senior manager who is also the compliance officer, the data controller and the person who orders the printer toner.

What the review is, in one paragraph

On 6 July 2026 the FCA published the Mills Review, a report to its Board by executive director Sheldon Mills on how AI could reshape retail financial services by 2030. It is not a policy statement and it changed no rules. It makes seven recommendations for the Board to consider and it says the existing regime is sound. The FCA Chair’s response named the two things that regime rests on: the Consumer Duty and the Senior Managers Regime. Separately, the FCA has said it will publish an AI good and poor practice piece later this year. Verified 21 September 2026; nothing has landed yet.

So the question for a small firm is not “what new rule do we need to meet”. It is “what does the regime we already meet look like when applied to the AI we are already using”. That last clause is the one people skip.

You are already an AI-enabled firm, whether you meant to be or not

Ask a small advice firm what AI it uses and the first answer is often “none, we are not that kind of firm”. Then the list starts. Copilot arrived with the Microsoft 365 renewal and now sits in Word and Outlook. The meeting-notes tool in Teams summarises client conversations. The cashflow modelling platform added an AI assistant in a release nobody read the notes for. The paraplanner has a ChatGPT tab open for first drafts of suitability reports, on a personal login, because it is faster. The provider platform’s chatbot answers the administrator’s questions about transfer forms. The back office system has “smart” something in the menu bar.

In regulated environments the honest inventory is always longer than the official one. The gap between them is where the risk lives, because the tools nobody sanctioned are the tools with no record. A firm of six that asks properly tends to find a longer list than it expected. None of it is exotic. All of it touches client information or client outcomes in some way.

The review gives you the vocabulary for sorting them. Its autonomy spectrum describes the human’s role at five points: Operator, where a person uses the tool on demand and remains the author; Collaborator; Consultant, where the tool compares and recommends; Approver, where the tool prepares and a person authorises; and Observer, where the tool acts continuously within limits and a person monitors. For a small advice firm the mapping is short. The paraplanner drafting in Copilot is an Operator. The meeting summariser that feeds straight into the file note is somewhere between Collaborator and Approver, depending on whether anyone reads it before it becomes the record. A workflow that generates the suitability report for the adviser to sign is an Approver. The review is explicit that the further along the spectrum a use sits, the more the regulator will want to know what the human actually does.

You do not need a model risk framework to write this down. You need a table with three columns: the tool, what it touches and where it sits on the spectrum. One page.

Your clients are already using ChatGPT about their money

The second thing the review does for a small firm is describe the other side of the desk. The FCA commissioned Yonder Consulting to survey more than 5,000 UK retail financial services consumers in April 2026. Already 16% use AI for personal finance, mainly to summarise, explain and compare. When general-purpose tools such as ChatGPT, Claude or Gemini are used for financial advice, only around two in five people correctly identify the level of protection available, which is to say that a majority do not know there is no formal route to redress. Some 68% are concerned about misuse of their personal and financial data and 67% about a lack of protection if something goes wrong.

The review’s first recommendation asks the FCA to look, within three to six months, at how consumers are using these tools across savings, investments, pensions, mortgages and debt, and whether the perimeter still holds. That is the regulator’s problem to solve, and I would not predict the answer. What I would predict is the conversation in your meeting room. The client arrives having asked a chatbot whether they should transfer the defined benefit scheme, and the chatbot gave a confident, specific, partly wrong answer with no reference to their circumstances. Some advisers find this threatening. It is the opposite. It is the clearest demonstration a client will ever see of what regulated advice is for: a named person, accountable to a regulator, working from the client’s actual facts, with a route to the Ombudsman if it goes wrong.

The practical implication is small and worth doing. Decide, as a firm, how you handle “ChatGPT said” when it comes up. Write the position down. Not a script, a stance: we will look at what it told you, we will explain where it is right and where it is missing your circumstances, and the recommendation you get from us is ours, evidenced in your file. That stance is a Consumer Duty support outcome in plain English, and it will be a differentiator for exactly as long as it takes the rest of the market to notice.

What a supervisor can reasonably expect from a firm of six

This is where the proportionality question lives. The review is more helpful than its length suggests. It does not ask for AI committees, model inventories with version control or a Chief AI Officer. It asks whether a firm understands, controls and can account for what its AI does, and it says human oversight only counts as a control where the reviewer has the right information and can interrogate what the system produced. Under SM&CR the person who will be asked about this is not the firm. It is the senior manager whose function covers the activity, and in a small firm that is usually one name.

Read that against your inventory and the expectation becomes concrete. For each use that touches a client, someone can say who approves the output, what they are required to see and check before approving it and how a disagreement with the tool is recorded. For a paraplanner’s Copilot draft that paragraph is short: the adviser reads the full report against the fact-find before signing, and the draft is not the record, the signed report is. For the meeting summariser it is a sentence about who reads the summary before it enters the file and what happens when it is wrong. A page per use, a handful of uses.

Then the reconstruction test. The review’s phrase is that a useful answer is not enough if the basis for it cannot be reconstructed. For a small firm this is a records question: for any output that shaped advice, could you say six months later what went in, which tool and version produced it and what the human did with it. Where the answer is “the paraplanner’s personal ChatGPT history”, that is the gap. Closing it is a matter of moving the use onto a firm account with retention, not a matter of buying anything.

Three documents. A one-page register with the spectrum column. An approval page per client-touching use. A note on where the record of each output lives. Name the SMF who owns the set and date it. That is what “reasonable steps” will look like when the good and poor practice examples arrive. It is also what a supervisor visiting a firm of six can reasonably expect to find.

Three things not to do

Do not ban the tools. In regulated environments I have watched a ban on a general-purpose AI tool move the use from the firm’s laptops to personal phones within a week, which converts a governance question you could answer into one you cannot see. Sanction the tools people are already using, on firm accounts, with the rules above, and the honest inventory and the official one become the same list.

Do not buy a compliance platform to solve a paperwork problem. The AI governance vendors are arriving with dashboards. For a firm with a handful of uses and one senior manager, the dashboard is more governance than the AI. The three documents above are a Word file and an afternoon. Spend money when you have a use at Approver level or beyond that runs at volume, not before.

Do not wait for the good and poor practice publication to start. It will describe firms that met obligations that already apply. Reading it with nothing written down is a worse afternoon than reading it with three pages to check against. The targeted support regime that went live in April is a reminder of how quickly the shape of advice is changing around small firms; the ones that can account for their AI will be the ones in a position to use it.

The honest limits

I should say what this does not cover. The review is a report, not a rule, and the Board has not yet said which recommendations it will act on. The good and poor practice examples may set a bar in places I have not anticipated. The perimeter review may change the competitive picture for advice in ways nobody can price today. Nothing in this article is legal advice, and for the regulatory position of your own firm you should speak to your compliance adviser. What I am confident of is narrower: a firm that has written the three pages will be in a better position under every one of those outcomes than a firm that has not, and the writing takes a fortnight of part-time attention, not a project.

If you would rather do it with someone who has built and run AI inside regulated environments, our fixed-scope AI Adoption & Governance Assessment produces exactly this set for a small firm: the inventory, the spectrum map, the approval design and the accountability line, in the vocabulary the FCA now uses. It is the same first two phases we apply to every AI deployment, sized for six people rather than six thousand.